Alertas de Seguridad de la Información

M Alto vulnerabilidad

12/10/2026

[CVE-2026-18537] IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable t…

IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image reference in a Kubernetes operator template.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-109566] Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows rem…

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authoriz…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109567] Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the …

Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users permission to assign themselves the admin role. Attackers holding roles such as the shipped operator role can submit the admin role ID for their own account, lifting tenant scoping, bypassing per-record authorization, and enabling im…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109568] Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Ches…

Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} with numeric IDs to overwrite or delete other users' content, including private items.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109569] sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container w…

sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem because nsenter attaches without --root. Agent-run code in a container workspace can resolve absolute paths on the host to read and modify host files, bypassing documented isolation.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109559] EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers l…

EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109560] Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allow…

Continue CLI (@continuedev/cli) through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;, && or | to execute code as the user.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109563] N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer num…

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109380] modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to p…

modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerability that allows attackers to produce negative entry sizes via non-octal bytes parsed by readOctal(). Attackers can supply a crafted, optionally gzip-compressed, archive to unpackTar() that buffers chunks indefinitely, exhausting process memory and suppressing later entries.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109426] Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with…

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode_string f…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109556] EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the deskto…

EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privil…

nvdaltovulnerabilidad CVSS 8.0 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109557] EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview …

EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-109558] EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane…

EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge.

nvdaltovulnerabilidad CVSS 8.7 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2026-108929] A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of th…

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2026-105052] IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse…

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

12/10/2026

[CVE-2025-71429] GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py …

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2021-48012] fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify…

fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass.

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2020-37279] easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attack…

easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2020-37280] cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts decl…

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

12/10/2026

[CVE-2021-48011] Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remot…

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI() decodes before path.join() in serveStaticFile and serveDirectoryListing, to read arbitrary files and list directories outside the root.

nvdaltovulnerabilidad CVSS 7.5 NVD